<div id="guide">
<div class="guidemenu">
<p><b>Menu</b></p>
<ul>
	<li><b><a href='#main'>Main</a></b></li>
	<li><b><a href='#more'>More</a></b></li>
	<li><b><a href='#seq'>Sequential View</a></b></li>
	<li><b><a href='#score'>Scoring</a></b></li>
	<li><b><a href='#mal'>Maleagents</a></b></li>
	<li><b><a href='#stats'>Some Stats</a></b></li>
	<li><b><a href='#widg'>Widget</a></b></li>
	<li><b><a href='#ser'>Search Engine Referrer</a></b></li>
	<li><b><a href='#opt'>Options</a></b></li>
	<li><b><a href='#prge'>Purging</a></b></li>
	<li><b><a href='#cred'>Credits</a></b></li>
	<li><b><a href='#'></a></b></li>
</ul>
</div><!--guidemenu-->
<div class="guidemain">

<h2>ecSTATic &mdash; Help!</h2>

<p><b>Welcome</b> to the program.&nbsp; I hope you're as ecstatic about ecSTATic as I am.</p>

<p>Having made it this far, you've obviously found the little menu that pops out of the gray, green, and blue button at the left of the screen.&nbsp; Let us walk along...

<p><b><a name="main">Main</a></b> &mdash; The most used page of the suite.&nbsp; There are a number of settings (all found on the Options page) that control the display.</p>

<p>The "ecSTATic" banner/graph across the top can be turned on or off.&nbsp; When on, the graph displays accumulated visitor totals, in three formats.&nbsp; To the left are monthly totals going back a year.&nbsp; In the middle, current day, month, and year totals.&nbsp; On the right half, daily totals of the X most recent days, with X being settable in Options.&nbsp; The left and right graphs are broken into six components, any of which may be turned on or off.&nbsp; Turning the figures off does not affect the accumulation of the underlying data.&nbsp; The six graphed layers are (from the bottom of the graph up): number of individual visitors, number of pages viewed by those individuals, number of feed readers, number of pages retrieved by those readers, number of separate spiders/bots, and the total number of pages queried by those spiders/bots.&nbsp; Hovering the mouse over the little graph bars pops up informative tool tips.&nbsp; You can see all the saved numbers there.&nbsp; The dates under the bars on the right side graph can be clicked to retrieve the visits on each particular day, if there were any, and if they haven't been <a href='#prge'>purged</a>.&nbsp; The row headings on the table in the middle of the graphs may be clicked, too.</p>

<p>Below the graph are what are called the main panels, and there are three of them, and they, too, may be turned on or off.&nbsp; In default order the panels are: "Visitors", "Feed Readers", and "Spider/Bots".&nbsp; Currently, the panels are displayed one after another, so that to see the Spider/Bot listing, one must scroll down and down.&nbsp; Each panel may be viewed singly, of course, via the main menu, or the row headings in the stats table at the top of the page.&nbsp; Or, the panels can be set to display in some alternate order, again via the Options page.</p>

<p>Each panel lists the most recent visitors (or RSS visitors or Spider/Bot visitors) going back for a given span of time.&nbsp; The default setting is for twenty four hours, so if you load the page at noon, you'll see all the visitors back to noon of the day before.&nbsp; And here's where it gets complicated.&nbsp; The title at the top of each panel reads "Visitors (or Feed Readers or Spider/Bots) for X hours", without giving a number to match that period, and <em>then</em> gives the current totals <em>for the current day</em>, from midnight on.&nbsp; In the panel below will be listed all the visitors for X hours, which will usually be <em>greater than</em> the number of visitors who have shown up from midnight on.&nbsp; The two periods will rarely match, so trying to count the current day's visitors in a listing that may show the intermingled visits of the last forty eight hours is fairly tricky to do yourself, though the program does it correctly.&nbsp; The further confusing thing is that all hits assigned to a single ID# will be grouped together, yet when a certain amount of time (settable in Options) has passed between hits, a NEW visit will be tallied and accurately reflected in the displayed totals, but the hits will still be listed next to each other.&nbsp; Once you get used to it, there is naught but peace and harmony.</p>

<p>The ecSTATic plugin is likely unique in the way it groups visitors in the main panels.&nbsp; Instead of merely listing hits in the order they occur (The main menu Sequential page does that), hits are grouped by matching IP/User Agent strings.  The method isn't infallible, but suffices over the short term.&nbsp; The rest of the items ought need little explanation (except for the scoring, perhaps, which is discussed further below.)&nbsp; ecSTATic renders the page requests into click-able links, in case one would like to see which page the visitor visited.&nbsp; To the right of each record, near the edge of the screen, is a little button labeled "more".&nbsp; That, believe it or not, is the "more" button, and clicking it will pull up more information related to the particular visit with which it is associated.</p>

<p><b><a name="more">More</a></b> &mdash; The More details pages are a cornucopia of hodge podging delights, most of it, one hopes, self-explanatory.</p>

<p>At the top are the IP address, and the User Agent string from the browser of the visitor under scrutiny, along with the result of a reverse DNS lookup that tries to determine the domain through which the visitor requested pages.&nbsp; Then, for fullness's sake, the program attempts to parse the visitor's user agent string to suss the renderer, browser, and OS.&nbsp; In some cases, the routines may not come up with useful answers.</p>

<p>Next down the pages comes the results of a quick WhoIS request, and a little IP geo-location.&nbsp; The info there can be helpful for blocking miscreants and ne'erdowells, as well as fools and their ilk.&nbsp; Please remember, though, that geo-location is inexact in almost all respects, and best regarded as a matter of interest or curiosity.&nbsp; That said, there is a default geo-locating function built into ecSTATic that uses a free service at <a href='http://www.geoplugin.com/' target='blank'>http://www.geoplugin.com/</a>, a site that uses Maxmind's geolocation database and routines.&nbsp; However, if one wishes to not rely on an external website for these functions, ecSTATic has a hook to the same Maxmind database and routines, provided that the user goes to the trouble to download the database (something over twenty five megabytes), and the API files, and then upload them into the wp-content/ecstatic folder.&nbsp; If that's how you want to fly, go to <a href='http://geolite.maxmind.com/download/geoip/api/php/' target='blank'>http://geolite.maxmind.com/download/geoip/api/php/</a> and grab the "geoip.inc", "geoipcity.inc", and "geoipregionvars.php" files.&nbsp; Then go to <a href='http://www.maxmind.com/app/geolitecity' target='blank'>http://www.maxmind.com/app/geolitecity</a> and click the "Download the latest GeoLite City Binary Format" link.&nbsp; A new version of the big database comes out around the second day of every month, while the other files are seldom, if ever, updated.  Unzip the database, and upload it, with the three aforementioned files, to your wp-content/ecstatic folder.&nbsp; ecSTATic should see the files and begin using them automatically.&nbsp; Whichever function ecSTATic uses, the info returned will largely be identical, and will include latitude and longitude information, which ecSTATic packages into a short link that opens a new window to Google Maps.</p>

<p>Next to the WhoIS/GeoIP block is a small form for augmenting ecSTATic's WhiteList/NoLog/Kill/Spider table.&nbsp; One can mark visitors as bots and spiders, block them from accessing one's website, eschew them the privilege of being logged, or pass them through unmolested by any other factors.&nbsp; All four functions are handled in the same form, and are pretty straight forward.&nbsp; The big table holds tokens used to identify visiting entities.&nbsp; The tokens can be IP numbers, or represent a range of IP numbers, or be part of a User Agent String, or part of the visitor's Referrer string, or even a part of the Requested URI (probably not used often, but useful when needed.)&nbsp; If you are bothered with referral spam, now you can block the annoyances with just a couple clicks.</p>

<p>The form has an entry for the "Common Name" that will show up in subsequent encounters with the entity under consideration.&nbsp; Fill it in with something meaningful.&nbsp; Select which <i>TYPE</i> of token you wish to identify the entity with, either "IP", "User Agent", "Referrer", or "Requested URI".&nbsp; For your convenience, some of the associated fields will be pre-filled in, but most likely you'll want to edit them in some way.&nbsp; It isn't necessary to use the entire GoogleBot User Agent string to identify the Google search bot, for instance.&nbsp; To flag the Google spider as such, one could type Google in the "Common Name" box, select the "User Agent Token" radio button, enter "googlebot" in the box to the left, click the Spider/Box select box, and click the "Submit Token" button.&nbsp; ecSTATic should come back with a confirmation blurb.&nbsp; Entries may be flagged with more than one parameter simultaneously by checking the relative boxes. </p>

<p>In the "Range or IP#" slot choose between the offered Range (if the program detects one) or the current IP, or roll your own range.&nbsp; One can use "*" as a wild card character (anyone remember DOS???), and "-" to give a range.&nbsp; If one wanted, as an example, to ban visitors with IPs in the range of 38.112.0.0 to 38.119.255.255, one would enter the string 38.112-119.*.*  One may also enter an IP block in CIDR notation (like 38.112.0.0/16) which will then automatically be converted into an ecSTATic compatible range.&nbsp; Entering a range that ecSTATic can't parse correctly will return an error, so that one may try again.</p>

<p>Any visitor that trips one of the flags in the WNKS table will be noted there.  Visitors marked with NoLog will not be recorded in the main "hits" table, but will still be tallied in the WNKS table, with a running count of their sightings.  Visitors granted the WhiteList designation will have any accumulated score set to -1, ie., they cannot be Killed.&nbsp; Since Version 0.90, when it became possible for visitors to trip several entries in the table, the XWList flag is used to override any WhiteList flag that may have also been tripped.&nbsp; For instance, I've Killed all traffic coming out of Microsoft.com, but I've Whitelisted the Bing Spider.&nbsp; However, there are some visitors who try to spoof the Bing spider, and I hit them with the XWhiteList.</p>

<p>Moving on, the main middle of the window consists of a javascript-driven set of tabs displaying visitors in different groupings.&nbsp; The first tab shows the history of visits from the IP/User Agent combination shown at the top of the page.&nbsp; The IP tab shows the history of visitors with only the IP of the current visitor.&nbsp; Likewise with the User Agent tab.&nbsp; There will similarly be a Referrer tab and a Req. URI tab, if there was a non-blank referrer passed along, and, respectively, if the Requested URI was for pages other than the blog's "home" page, which nearly everyone visits.&nbsp; Likewise, if the visitor under consideration hails from an identifiable Domain, there is a Domain tab, listing all (or up to the max setting on the Options page) visitors from the same Domain.&nbsp; Sometimes the tabs show useful patterns, sometimes they don't.</p>

<p>Next is the big WNKS table, wherein is listed all the entities that are flagged with the Spider/Bot, Kill, NoLog, WhiteList, and XWhiteList bits.&nbsp; When first loaded, the list is sorted with the most recently seen entries at the top.&nbsp; The user can sort up or down by any of the column headings, as needed.&nbsp; One can see at a glance whether there are entries similar to any that are perhaps being considered for subsequent addition.&nbsp; One can also see the last time any of the tokens were of use, or if they sit there wasting space.&nbsp; Any of the list entities can be edited in place just by clicking on appropriate row.&nbsp; The row will open up as its own form, and one can edit the tokens, etc., or toggle the WNKS bits, Save, Cancel, or Delete the entire entry.</p>

<p>To the left of the WNKS table are a couple of forms, one for filtering the table by different factors, and exporting the table as filtered by those factors, for backup, if one wishes.&nbsp; The second small form allows one to import saved or updated WNKS lists directly from one's hard drive.&nbsp; Read the fine print there for helpful suggestions.</p>

<p>The rightmost tab is the "Search" tab.  Search for simple words or phrases amongst the saved IP, Domain, User Agent, Referrer, and Requested URI data.</p>

<p><b><a name="mal">Maleagents</a></b> &mdash; Resembles the Visitors, Feeds, and Spider/Bots panels, but shows those visitors who were KILLed, or blocked.</p>

<p><b><a name="seq">Sequential</a></b> &mdash; Shows everyone in chronological order for the same period of time specified for the other panels.&nbsp; Regular visitors, RSS visitors, bots, spiders, blocked entities, all, are listed from most recent to least recent.&nbsp; The entries in the "Domain" column are styled and color coded according to the key just above the main table.&nbsp; Said stylings and colorings are adjustable in the ecstatic.css file.&nbsp; Look for the "Sequential colors" section.&nbsp; Clicking any of the "Score" entries down the right side of the Sequential page opens up the Details/Mash page for the respective entry.</p>

<p><b><a name="score">Scoring!</a></b> &mdash; A rudimentary scoring system can be applied to visitors.&nbsp; When the accumulated score reaches ten and beyond, the visitor is blocked, and a 403 Forbidden response is sent back instead of the requested page.</p>

<p>Score points can be earned a dozen different ways.&nbsp; Eight of them are user-settable at the bottom of the Options page in the "Anti-Maleagant Scoring" section.&nbsp; If scoring isn't needed or wanted, set everything there to zero, and keep the "Domain Check" and "Enable WTF" boxes unchecked.&nbsp; The score categories there are self-explanatory (and explained), but should be used with caution.&nbsp; Give the "login" check too high a parameter and you won't be able to visit your own blog.&nbsp; And remember, points are cumulative, and things can add up to ten quickly.</p>

<p>Individual IPs, User Agents, Referrers, and Requested URIs can also be scored.&nbsp; On the Details (aka More) pages, each of the respective tabs has its own little form that shows the current relative score and allows a new one to be applied.</p>

<p>And finally, a straight out KILLing score of ten can be applied, also on the Details pages, via the "Spider/Bot Kill Nolog Whitelist" form at the upper right of the page (described above in the "More" section.)</p>

<p>Technically speaking, there are two main ways to KILL unwanted visitors.&nbsp; One is to enter the proper tokens into the WNKS list with the KILL box checked, and the other is to apply individual scores to the IPs, User Agents, etc. in their respective tabs.&nbsp; The WNKS list is very fast, but the whole list must be scanned for every visitor, while the individual scores for IPs, User Agents, Referrers and Req. URIs (the latter seldom used, really) are automatically loaded straight out of the database as a matter of course.&nbsp; If you find yourself entering a lot of straight IP addresses (as opposed to IP ranges) into the WNKS list, you might consider giving a score of ten to the IP in the IP tab instead.&nbsp; However, the WNKS list does keep track of hits and last visits, which isn't done for the straight scoring.</p>

<p><b><a name="stats">SomeStats</a></b> &mdash; All the little graphs.&nbsp; The entries in them can be sorted two ways, via a setting in the Options page.&nbsp; I like them alphabetically, but they look nice, too, by ranking.&nbsp; Also, the number of entries to be displayed is settable, again, via the Options page.</p>

<p><b><a name="widg">Widget</a></b> &mdash; Not on the main menu, the Widget options are found in the WordPress Widget page, found via the WordPress Appearance button in your dashboard.&nbsp; Before visiting the WordPress Widget page, be sure to enable the Widget in ecSTATic's Options page.&nbsp; Additionally, your theme must be Widget-ready, etc.</p>

<p>Find ecSTATic in the list of available widgets and drag it over to the appropriate Sidebar box and drop it.&nbsp; Title is optional.&nbsp; The default labels may be overwritten, and the default order changed.&nbsp; Select as many or as few of the offered variables as desired.</p>

<p><b><a name="ser">Search Engine Referrer Stylin'</a></b> &mdash; The hidden page!&nbsp; One can only reach the Search Engine Referrer Stylin' page after a Search Engine (think Google) has left a referrer from a person who used the Search Engine to arrive at your site.&nbsp; When ecSTATic sees such a referrer, it parses it into two separate links, the first of which is associated with the referring domain and leads to the Search Engine Referrer Stylin' page.&nbsp; The second link is associated with the terms of the original search the visitor used to find your site, and is an attempt to reproduce that search.&nbsp; In other words, ecSTATic saves you the trouble of finding, cutting, and pasting the terms out of the referrer, and calls up the referring search engine, too.&nbsp; There is much more information on the particulars of the Search Engine Referrer Stylin' page on that page.&nbsp; The table there can be Imported and Exported (like the Spider, KILL, and NoLog tables described further above).&nbsp; New ecSTATic installations will automatically Import the "aux_se.xml" file, but it is highly recommended that existing users manually import the included file by clicking the Import button at the bottom of the big table on the Search Engine Referrer Stylin' page.&nbsp; The updated entries (which won't replace any of your existing entries) will prove helpful and informative in further enhancing the usefulness of the routines. </p>

<p><b><a name="opt">Options</a></b> &mdash; Mostly self-explanatory.&nbsp; And it's hard to mess anything up.&nbsp; All entries are checked for validity and matched to a range, so entering values outside what's expected returns settings to their default.</p>

<p><b><a name="dns">Reverse IP Lookup</a></b> &mdash; Turn IPs into Domain names.&nbsp; Some servers come with programs that users can access to run DNS queries, and some don't, so ecSTATic gives five options to try to cover all the bases.&nbsp; Host, nslookup, and dig are each powerful tools, and give good error info if they can't find the Domain, so try them first.&nbsp; The gethostbyaddr() and dns_get_record() are PHP functions and should work for nearly everyone else, though on some systems dns_get_record may not work without PHP v. 5.3 running.</p>

<p><b><a name="prge">Purging</a></b> &mdash; Out with the old.&nbsp; Eventually, the database tables grow large and full of old data, and must be purged.&nbsp; There are three settings in the Miscellaneous section of the Options page, one for Spider/Bots, another for Feed Reads (which can pile up quickly), and another for everything else.&nbsp; Setting the values to zero (0) will disable purging, otherwise, entities older than specified will be permanently deleted from the main Hits table as specified.&nbsp; As entities are so deleted, it will inevitably be that there are entries in the IP, User Agent, Referrer, and Requested URI tables that are no longer referenced in the Hits table, and they, too, will be purged when detected.&nbsp; Also, as new entries are inserted, and old entries purged, the tables may accumulate wasted space, or become fragmented.&nbsp; At the end of every purge, the tables are checked for excessive "overhead", and when the overhead reaches 5%, the tables are Optimized.  The purge routines are executed every time the Main Panels (Regular, Feed, or Spider/Bots) are loaded, or when the Maleagents page is called up.&nbsp; The purge routines are not run from the Sequential View page, or any of the others.&nbsp; A small block of "Purged" stats can be found at the bottom of the Main Panels page.</p>

<p><b>Help!</b> &mdash; This->page.</p>

<p><b><a name="cred">Credits</a></b> &mdash; Where credit is due.</p>

<p class="credit"><a href='http://wordpress.org/extend/plugins/statpress/'>Daniele Lippi</a> &mdash; Wrote StatPress, the original, which ended up being augmented by... </p>

<p class="credit"><a href="http://wordpress.org/extend/plugins/statpress-reloaded/">Manuel Grabowski</a> &mdash; Wrote StatPress Reloaded, "a highly improved fork of StatPress".&nbsp; ecSTATic was at first based on StatPress Reloaded, but ended up with a completely different database structure, and entirely rewritten functions.</p>

<p class="credit"><a href="http://earthli.com/software/browser_detector/">Marco Von Ballmoos</a> &mdash; Wrote the "earthli Browser Detector" routines which ecSTATic uses to parse user agent strings.</p>

<p class="credit"><a href="http://www.wait-till-i.com/">Christian Heilmann</a> &mdash; Wrote the javascript/CSS <a href="http://onlinetools.org/tools/domtabdata/">DOMTAB</a> functions used in ecSTATic's MORE pages.</p>

<p class="credit"><a href="http://www.leigeber.com/2009/03/table-sorter/">Michael Leigeber</a> &mdash; Wrote the javascript TinyTable Table Sorter used to sort ecSTATic's various tables. </p>

<p class="credit"><a href="http://www.overset.com/2008/09/01/javascript-natural-sort-algorithm-with-unicode-support/">Jim Palmer</a> &mdash; Wrote the javascript Natural Sort function which I spliced into the TinyTable Sorter to sort IP addresses. </p>

<p class="credit"><a href="http://www.geoplugin.com/">geoPlugin</a> &mdash; Free geolocation service that uses Maxmind's geolocation database.</p>

<p class="credit"><a href="http://www.maxmind.com/app/ip-location">Maxmind</a> &mdash; Providers of the GeoLite City database and the GeoIP API that ecSTATic is equipped to hook into.</p>

<p class="credit"><a href="http://www.iso.org/iso/prods-services/iso3166ma/02iso-3166-code-lists/list-en1-semic.txt">ISO.org</a> &mdash; Providers of the country_file.txt file containing country names and country codes, used in ecSTATic's routines.</p>

<p class="credit"><a href="http://wordpress.org/">WordPress</a> &mdash; You know, just for being there.</p>

<br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br />

</div><!--guidemain-->
</div><!--guide-->